A title office in Fort Lauderdale wires closing funds to what reads as the seller's bank. The email came from the right address, quoted the right file number, and landed the morning of closing. Someone had been sitting in the agency's mailbox for three weeks, waiting for exactly that file. Nationally, this kind of loss averages well over $137,000, and the wire is usually gone before the real seller calls.
Most Florida small businesses meet that scenario with a cyber endorsement bolted onto a business owner's policy, carrying a limit somewhere between $25,000 and $100,000. The endorsement is not worthless. It is also not sized for the loss it is most likely to see, and the part of it that pays for a spoofed payment is usually a sublimit inside the sublimit.
Florida Ranks Third in the Country for Cybercrime Losses
The FBI's Internet Crime Complaint Center logged 1,008,597 complaints in 2025, the first year past a million, and $20.877 billion in reported losses. Florida placed third among states in both complaint volume and dollars lost, with an average reported loss of roughly $20,699 per incident. Business email compromise alone accounted for $3.046 billion of the national total, second only to investment fraud.
Those numbers land hard in Broward and Miami-Dade for a structural reason. The local economy runs on businesses that move other people's money on a deadline: title agencies, real estate brokerages, property managers holding owner funds, construction firms paying subs, import and export shops wiring overseas. A criminal does not need to breach a bank. They need one mailbox and a calendar.
General liability does not respond to a data breach or a stolen wire. Neither does commercial property. A CGL policy covers bodily injury and physical property damage to a third party, and most carriers have added an explicit electronic data exclusion. This is a separate line of coverage, not a feature of one you already own.
The 30-Day Clock in Florida Statute Section 501.171
The Florida Information Protection Act sits at Florida Statute Section 501.171, and it applies to any business that holds computerized personal information about Florida residents. There is no employee-count floor and no revenue floor. A six-person insurance office and a 600-person hospital system are both covered entities.
A breach under the statute means unauthorized access of data in electronic form containing personal information. Good-faith access by your own employee is not a breach, provided the data is not used for something unrelated to the business. Once you determine a breach happened, the clock starts:
| Trigger | What the statute requires | Deadline |
|---|---|---|
| Any breach affecting Florida residents | Written notice to each affected individual | 30 days from determining the breach, plus up to 15 more for good cause |
| 500 or more Florida residents affected | Notice to the Florida Department of Legal Affairs | 30 days |
| More than 1,000 individuals at a single time | Notice to the nationwide consumer reporting agencies | Without unreasonable delay |
| Breach inside a vendor's system holding your data | The vendor must notify you | 10 days from determining the breach |
Section 501.171 gives no private right of action, so an affected customer cannot sue you under this statute directly. Enforcement runs through the Attorney General as a deceptive and unfair trade practice, and the penalty schedule is steep: up to $1,000 per day for the first 30 days a notice is late, then up to $50,000 for each subsequent 30-day period, capped at $500,000 per breach.
Read that 30-day deadline as an operational requirement, not a legal one. Meeting it means you already know which records were touched, which of those people live in Florida, and what you are going to tell them. A forensics firm engaged on day 22 will not get you there. That readiness is most of what you are buying when you buy a real cyber policy.
Florida Has No Safe Harbor. A Bill Creating One Was Vetoed.
Business owners sometimes assume that following a recognized security framework shields them from liability after a breach. In some states it does. In Florida it does not, and the near miss is worth knowing about.
House Bill 473, the Cybersecurity Incident Liability Act, would have given covered entities immunity from tort claims after a cyber incident if they maintained a program substantially aligned with a recognized framework such as NIST or the CIS Critical Security Controls. It passed the House 81 to 28 and the Senate 32 to 8. Governor DeSantis vetoed it on June 26, 2024, reasoning that across-the-board protection for merely substantial compliance would push businesses toward the minimum standard and leave Floridians' data less secure.
Adopting NIST or CIS controls is still the cheapest thing you can do, and carriers price it: multi-factor authentication, offline backups and endpoint detection move a cyber quote more than almost anything else. What those controls do not do in Florida is give you a statutory defense. The policy is the backstop.
What a $25,000 Cyber Endorsement on Your BOP Actually Covers
Pull the endorsement pages out from behind your declarations page and look for two things: the aggregate limit for the endorsement, and the schedule of sublimits underneath it. Most bundled endorsements are built for first-party breach response on a small scale. They pay for notification letters, credit monitoring and some legal guidance, which matters, and they run out fast.
| Coverage | Cyber endorsement on a BOP | Standalone cyber policy |
|---|---|---|
| Total limit | $25,000 to $100,000 typical | $1,000,000 and up |
| Spoofed payment / social engineering | $10,000 to $25,000 sublimit, sometimes excluded | $100,000 to $250,000 sublimit |
| Ransomware payment and data recovery | Often narrow or absent | Covered with its own limit |
| Business interruption from your own outage | Rarely included | Included |
| Dependent interruption when a vendor platform goes down | Almost never | Commonly included |
| Breach response bench | Limited, often a phone number | Named forensic, legal and notification vendors on retainer |
The gap is not academic. Reported averages put a small-business cyber claim around $170,000 and a ransomware claim near $450,000. A $25,000 endorsement against a $170,000 event is a deductible with a friendly name.
The Coverage That Pays for a Spoofed Wire, and the One That Does Not
This is the distinction that decides the title agency claim above, and it turns on two phrases that sound interchangeable and are not.
- Funds transfer fraud covers money moved out of your account by a criminal who got into your systems or impersonated you to your bank. No employee authorized it.
- Social engineering fraud covers money your own employee sent voluntarily, because a convincing email told them to. The transfer was authorized. The instruction was fake.
Nearly every spoofed-invoice and diverted-closing loss is the second one. Many cyber forms cover the first automatically and treat the second as a separate endorsement with its own much smaller sublimit, and some exclude it outright. Carriers that do write it often attach conditions: callback verification to a phone number on file before any wire over a stated amount, dual authorization above a threshold, or written confirmation of any change to banking instructions. Fail the condition and the claim fails with it.
Ask your agent one question in writing: what is the social engineering sublimit on this policy, and what verification steps are conditions of coverage? If the answer is a sublimit under $100,000 and you wire six figures on a routine basis, the policy is not sized for your business.
What Cyber Liability Insurance Costs a Florida Small Business
Cyber is inexpensive relative to what it covers, which surprises owners who expect it to price like professional liability. Most small businesses land between $52 and $300 per month for a $1,000,000 limit, and reported averages for a $1,000,000 policy sit near $1,000 to $1,500 a year. Businesses under $5,000,000 in revenue typically pay $1,500 to $3,500 annually once the exposure is real.
| Business type | Typical annual premium, $1M limit |
|---|---|
| Contractor or trade shop | $1,000 to $2,000 |
| Restaurant or retail taking card payments | $1,000 to $2,500 |
| Professional services: accounting, legal, consulting | $2,500 to $5,000 |
| Medical or dental practice | $2,500 to $5,000 |
| Most businesses under $5M revenue | $1,500 to $3,500 |
Seven things move the number: your industry, your revenue, the limit you buy, the security controls you can attest to, your claims history, the specific features you add, and the carrier. The controls are the lever you hold. Multi-factor authentication on email and remote access, backups kept offline, and a documented wire verification procedure will each earn a better rate, and some carriers will not quote a business without the first one.
Which South Florida Businesses Should Not Wait
Every business with a mailbox has some exposure. These carry enough that a bundled endorsement is the wrong answer:
- Title agencies, real estate brokerages and closing attorneys, where a single diverted wire exceeds any endorsement limit written.
- Property managers holding owner funds and tenant deposits in trust accounts.
- Medical, dental and behavioral health practices, which carry HIPAA obligations on top of Section 501.171 and hold the records criminals pay most for.
- Contractors and trade shops running payroll and paying subcontractors on a weekly cycle from one operating account.
- Restaurants, bars and retail stores storing card data, where a point-of-sale compromise triggers card brand assessments alongside state notice duties.
- Accounting, legal and consulting firms holding client financial records, often with a professional liability policy that excludes the breach itself.
If your business sits on that list, the pages to read next are Commercial Insurance in South Florida and Florida Business Owner's Policy, both linked below. Cyber is normally quoted alongside the BOP rather than instead of it, and the two are underwritten by the same submission.
The Florida-specific case for buying it is narrow and clear. You have a 30-day statutory notice deadline you cannot meet without a response team, penalties reaching $500,000 for missing it, a state ranked third in the country for cybercrime losses, and no safe harbor for doing security well. A $25,000 endorsement does not answer any of those. A policy built for the exposure answers all four for roughly what you spend on commercial auto for one van.